You want to actually remove it so it reads MZPE? There is a packer which does MZ<imports> (will have to find out the name for you cant remember which one it was). Doing it manually is an extremely difficult task because obviously the offsets will be seriously messed up.

OK, well you can cut the MZ header only so far (roughly have of the typical MZ header and the stub). The reason you can cut the whole thing out is because the MZ header contains a pointer (at 3Ch) to the PE header, so if you remove all of the MZ header so that the file reads MZPE the actually pointer to the PE header will actually be inside the PE header and the field it will be pointing to will be the imagebase in the PE header so if you do change that value to point to the PE header then you have just screwed the imagebase so the file will be corrupt. What i would recommend is cutting the bytes between the pointer to the PE header and upto the actual PE header tag. Any bytes you remove must be then placed AFTER the section table so all the offsets are corrected.

When i get a spare 15 mins I will try and put a video together for you unless you understand that all ok?

So have you got it working now? At first glance it looks ok, your pointer to the PE header seems fine. Did you pad it out (insert some bytes) after the section table so the offsets are corrected? Thinking about it you should be able to store the pointer to the PE header in the Major/Minor link version field of the PE header, thats probably the best your gona be able to get.

What do you need ollydbg for? You just need a decent hex editor like Hex Workshop. I will *try* and get the video done 2nite bud. Why are you so desperate to learn how to do this though? If your thinking it will make malware undetected it wont.